4 ms·

Why are the Security Departments of ever company so unfriendly? I feel like every blog post of a disclosed vulnerability has had some form or another of: - no r

Why are the Security Departments of ever company so unfriendly? I feel like every blog post of a disclosed vulnerability has had some form or another of: - no replies - delayed replies - vague replies - playing down the vulnerability - reducing the bounty It’s like they still treat a white hat hacker as a risk, instead o cooperating with them. I don’t get the corporations. The white hat hacker is in this case your best friend. They proved their ethics already by reporting it to them, and they know it already because they found it. There is literally no reason to try to keep the white hat hacker in the dark, not update them, etc. The white hat hacker could have exploited the vulnerability already!

beermonster 5y ago
I found and reported a security issue to Microsoft. They responded nearly right away and it was a real person . I was soon talking directly to the right team to explain it to. I provided assets required to replicate and they jumped right on it and fixed it. They even told me what KB* it was resolved in via follow up email. I didn’t want any kind of monetary reward - just happy to have it fixed. I regularly report security issues in open source projects too. Now, I also once tried to report a fairly serious issue that impacted iOS and MacOS X (at the time) and you’d have thought (naively) they’d have been super interested and helpful as Microsoft were. Wrong. In fact their first response basically meant I never ended up getting past their first auto reply.
- dandanua 5y ago
  That's a superiority complex. It can be seen especially well in Russia. I've read stories that their companies even start legal actions against white hackers that submit vulnerabilities to them.
  - contriban 5y ago
    This sounds like it happens a lot everywhere outside large American companies. The reasoning probably goes like “why were you even trying to break in, that’s illegal.”
    - jbarrs 5y ago
      >why were you even trying to break in Because you're offering money if a way in is found. I feel like that's most of their hesitance, really, they probably just don't want to pay the bounties.
  - faeyanpiraat 5y ago
    I’d say it is just incompetence. The group of people who run these corps are old enough not to be grown up with the internet, and some of them just can’t understand the dangers of this new world, even if you tried explaining it to them. They are missing the fundamentals.
    - darig 5y ago
      China understands this. That is why they engineered the China Virus. Thank you China.
  - toolslive 5y ago
    Not only in Russia. I once accidentally discovered a vulnerability in a rather popular job search site (EU). I reported it to them only to be harassed by their legal department afterwards. No good deed shall go unpunished.
    - willis936 5y ago
      No bad deed should go unpublished.
sneak 5y ago
They get the vuln in all cases if you are talking to them: either for free if you post it to f-d, or for some reduced rate (and hushed up) if you agree to the NDA to get the bounty. The people selling to rogue states and TAO aren't talking to the vendor in the first place. Bug bounty programs are, for the most part, bullshit.
rhn_mk1 5y ago
Confirmation bias? If the disclosure doesn't go as expected, that's an interesting event, which is likely to draw more attention than if everything was all right.
raverbashing 5y ago
Because they're not the only person the security team is dealing with? Because they need to verify the claim and see what it really affects? If there are other repercussions? Because you don't want to tell more than you need? (a security researcher should know that) Vulnerability disclosure is the closest thing to a protection racket that is actually legal. So it's natural that people will be on the edge. Sure, it beats the alternative.
nh2 5y ago
I submitted a memory corruption bug in glibc realloc() to Red Hat's security email contact, and they replied quickly and friendly.
- tinus_hn 5y ago
  Even Google Security was really friendly, even as I reported something that seemed like an issue but turned out to be my own fault
_notreallyme_ 5y ago
To be fair, there is also some whining involved on the "white hat hacker" side. Triaging reports is not an easy task. The issue I have often witnessed, is a higher up wanting to play down a vulnerability, or even make so nobody hears about it because they fear it will impact the stock price. You should not forget that there is a financial impact...
lima 5y ago
Bug bounty programs tend to get utterly swamped with low-quality reports and entitled researchers. It can be hard to separate signal from noise.
de6u99er 5y ago
Maybe because legal needs to be involved.
Zanneth 5y ago
The signal-to-noise ratio is very poor, especially for large companies running bounty programs. In addition to honest and diligent researchers, there are also scam artists, script kiddies, and soccer moms sending in false reports saying “my ten-year-old found this bug in FaceTime, pay up!”
aliasEli 5y ago
Security departments are there to protect against threats to the company. Bad publicity is a threat for companies. So never expect some company official to admit that there is a glaring hole in their security, until they are very, very sure that they have fixed it. Fixing a hole likes this can take a lot of time because you need a lot of testing. Apple is not going to tell the rest of the world what they are doing exactly because of possible bad publicity. When they have fixed the problem there are very good reasons for Apple to downplay its importance, which implies that they should pay some money but not too much.

beermonster 5y ago

I found and reported a security issue to Microsoft. They responded nearly right away and it was a real person . I was soon talking directly to the right team to explain it to. I provided assets required to replicate and they jumped right on it and fixed it. They even told me what KB* it was resolved in via follow up email. I didn’t want any kind of monetary reward - just happy to have it fixed. I regularly report security issues in open source projects too. Now, I also once tried to report a fairly serious issue that impacted iOS and MacOS X (at the time) and you’d have thought (naively) they’d have been super interested and helpful as Microsoft were. Wrong. In fact their first response basically meant I never ended up getting past their first auto reply.

dandanua 5y ago
That's a superiority complex. It can be seen especially well in Russia. I've read stories that their companies even start legal actions against white hackers that submit vulnerabilities to them.
- contriban 5y ago
  This sounds like it happens a lot everywhere outside large American companies. The reasoning probably goes like “why were you even trying to break in, that’s illegal.”
  - jbarrs 5y ago
    >why were you even trying to break in Because you're offering money if a way in is found. I feel like that's most of their hesitance, really, they probably just don't want to pay the bounties.
- faeyanpiraat 5y ago
  I’d say it is just incompetence. The group of people who run these corps are old enough not to be grown up with the internet, and some of them just can’t understand the dangers of this new world, even if you tried explaining it to them. They are missing the fundamentals.
  - darig 5y ago
    China understands this. That is why they engineered the China Virus. Thank you China.
- toolslive 5y ago
  Not only in Russia. I once accidentally discovered a vulnerability in a rather popular job search site (EU). I reported it to them only to be harassed by their legal department afterwards. No good deed shall go unpunished.
  - willis936 5y ago
    No bad deed should go unpublished.

sneak 5y ago

They get the vuln in all cases if you are talking to them: either for free if you post it to f-d, or for some reduced rate (and hushed up) if you agree to the NDA to get the bounty. The people selling to rogue states and TAO aren't talking to the vendor in the first place. Bug bounty programs are, for the most part, bullshit.

rhn_mk1 5y ago

Confirmation bias? If the disclosure doesn't go as expected, that's an interesting event, which is likely to draw more attention than if everything was all right.

raverbashing 5y ago

Because they're not the only person the security team is dealing with? Because they need to verify the claim and see what it really affects? If there are other repercussions? Because you don't want to tell more than you need? (a security researcher should know that) Vulnerability disclosure is the closest thing to a protection racket that is actually legal. So it's natural that people will be on the edge. Sure, it beats the alternative.

nh2 5y ago

I submitted a memory corruption bug in glibc realloc() to Red Hat's security email contact, and they replied quickly and friendly.

tinus_hn 5y ago
Even Google Security was really friendly, even as I reported something that seemed like an issue but turned out to be my own fault

_notreallyme_ 5y ago

To be fair, there is also some whining involved on the "white hat hacker" side. Triaging reports is not an easy task. The issue I have often witnessed, is a higher up wanting to play down a vulnerability, or even make so nobody hears about it because they fear it will impact the stock price. You should not forget that there is a financial impact...

lima 5y ago

Bug bounty programs tend to get utterly swamped with low-quality reports and entitled researchers. It can be hard to separate signal from noise.

de6u99er 5y ago

Maybe because legal needs to be involved.

Zanneth 5y ago

The signal-to-noise ratio is very poor, especially for large companies running bounty programs. In addition to honest and diligent researchers, there are also scam artists, script kiddies, and soccer moms sending in false reports saying “my ten-year-old found this bug in FaceTime, pay up!”

aliasEli 5y ago

Security departments are there to protect against threats to the company. Bad publicity is a threat for companies. So never expect some company official to admit that there is a glaring hole in their security, until they are very, very sure that they have fixed it. Fixing a hole likes this can take a lot of time because you need a lot of testing. Apple is not going to tell the rest of the world what they are doing exactly because of possible bad publicity. When they have fixed the problem there are very good reasons for Apple to downplay its importance, which implies that they should pay some money but not too much.